Home » Dell Manuals » Hubs & Switches » Dell PowerConnect 7048P » Manual Viewer

Dell PowerConnect 7048P User Manual - Page 539

Configuring Access Control Lists, ACL Overview

View all Dell PowerConnect 7048P manuals

Add to My Manuals
Save this manual to your list of manuals

Page 539 highlights

20 Configuring Access Control Lists This chapter describes how to configure Access Control Lists (ACLs), including IPv4, IPv6, and MAC ACLs. This chapter also describes how to configure time ranges that can be applied to any of the ACL types. The topics covered in this chapter include: • ACL Overview • Configuring ACLs (Web) • Configuring ACLs (CLI) • ACL Configuration Examples ACL Overview Access Control Lists (ACLs) are a collection of permit and deny conditions, called rules, that provide security by blocking unauthorized users and allowing authorized users to access specific resources. ACLs can also provide traffic flow control, restrict contents of routing updates, and decide which types of traffic are forwarded or blocked. ACLs can reside in a firewall router, a router connecting two internal networks, or a Layer 3 switch, such as a PowerConnect 7000 Series switch. The PowerConnect 7000 Series switches support ACL configuration in both the ingress and egress direction. Egress ACLs provide the capability to implement security rules on the egress flows (traffic leaving a port) rather than the ingress flows (traffic entering a port). Ingress and egress ACLs can be applied to any physical port, port-channel (LAG), or VLAN routing port. Depending on whether an ingress or egress ACL is applied to a port, when the traffic enters (ingress) or leaves (egress) a port, the ACL compares the criteria configured in its rules, in order, to the fields in a packet or frame to check for matching conditions. The ACL forwards or blocks the traffic based on the rules. Configuring Access Control Lists 539

Section	Page
Introduction	49
About This Document	49
Audience	49
Document Conventions	50
Additional Documentation	50
Switch Features	51
System Management Features	52
Multiple Management Options	52
System Time Management	52
Log Messages	52
Integrated DHCP Server	53
Management of Basic Network Information	53
IPv6 Management Features	53
Dual Software Images	53
File Management	54
Switch Database Management Templates	54
Automatic Installation of Firmware and Configuration	54
sFlow	55
SNMP Alarms and Trap Logs	55
CDP Interoperability through ISDP	55
Remote Monitoring (RMON)	55
Stacking Features	56
High Port Count	56
Single IP Management	56
Automatic Firmware Upgrade for New Stack Members	56
Stacking Compatibility with the PowerConnect M6348	56
Master Failover with Transparent Transition	57
Nonstop Forwarding on the Stack	57
Hot Add/Delete and Firmware Synchronization	57
Security Features	57
Configurable Access and Authentication Profiles	57
Password-Protected Management Access	58
Strong Password Enforcement	58
TACACS+ Client	58
RADIUS Support	58
SSH/SSL	59
Inbound Telnet Control	59
Denial of Service	59
Captive Portal	59
Dot1x Authentication (IEEE 802.1X)	60
MAC-Based 802.1X Authentication	60
Dot1x Monitor Mode	60
MAC-Based Port Security	60
Access Control Lists (ACL)	61
Time-Based ACLs	61
IP Source Guard (IPSG)	61
DHCP Snooping	62
Dynamic ARP Inspection	62
Protected Ports (Private VLAN Edge)	62
Green Technology Features	63
Energy Detect Mode	63
Energy Efficient Ethernet	63
Power Utilization Reporting	63
Power over Ethernet (PoE) Plus Features	63
Power Over Ethernet (PoE) Plus Configuration	63
PoE Plus Support	64
Switching Features	64
Flow Control Support (IEEE 802.3x)	64
Head of Line Blocking Prevention	64
Jumbo Frames Support	64
Auto-MDI/MDIX Support	64
VLAN-Aware MAC-based Switching	65
Back Pressure Support	65
Auto Negotiation	65
Broadcast Storm Control	65
Port Mirroring	66
Static and Dynamic MAC Address Tables	66
Link Layer Discovery Protocol (LLDP)	66
Link Layer Discovery Protocol (LLDP) for Media Endpoint Devices	66
Connectivity Fault Management (IEEE 802.1ag)	67
Cisco Protocol Filtering	67
DHCP Layer 2 Relay	67
Virtual Local Area Network Supported Features	68
VLAN Support	68
Port-Based VLANs	68
IP Subnet-based VLAN	68
MAC-based VLAN	68
IEEE 802.1v Protocol-Based VLANs	68
GARP and GVRP Support	69
Voice VLAN	69
Guest VLAN	69
Double VLANs	69
Spanning Tree Protocol Features	70
Spanning Tree Protocol (STP)	70
Spanning Tree Port Settings	70
Rapid Spanning Tree	70
Multiple Spanning Tree	70
Bridge Protocol Data Unit (BPDU) Guard	71
BPDU Filtering	71
Link Aggregation Features	71
Link Aggregation	71
Link Aggregate Control Protocol (LACP)	71
Routing Features	72
Address Resolution Protocol (ARP) Table Management	72
VLAN Routing	72
IP Configuration	72
Open Shortest Path First (OSPF)	72
BOOTP/DHCP Relay Agent	73
IP Helper and UDP Relay	73
Routing Information Protocol	73
Router Discovery	73
Routing Table	73
Virtual Router Redundancy Protocol (VRRP)	74
Tunnel and Loopback Interfaces	74
IPv6 Routing Features	74
IPv6 Configuration	74
IPv6 Routes	75
OSPFv3	75
DHCPv6	75
Quality of Service (QoS) Features	76
Differentiated Services (DiffServ)	76
Class Of Service (CoS)	76
Auto Voice over IP (VoIP)	76
Internet Small Computer System Interface (iSCSI) Optimization	77
Layer 2 Multicast Features	77
MAC Multicast Support	77
IGMP Snooping	77
IGMP Snooping Querier	78
MLD Snooping	78
Multicast VLAN Registration	78
Layer 3 Multicast Features	78
Distance Vector Multicast Routing Protocol	78
Internet Group Management Protocol	79
IGMP Proxy	79
Protocol Independent Multicast—Dense Mode	79
Protocol Independent Multicast—Sparse Mode	79
Protocol Independent Multicast—Source Specific Multicast	79
Protocol Independent Multicast IPv6 Support	79
MLD/MLDv2 (RFC2710/RFC3810)	80
Hardware Overview	81
PowerConnect 7000 Series Front Panel	81
Switch Ports	84
Console Port	85
Out-of-Band Management Port	85
USB Port	85
Reset Button	86
Port and System LEDs	86
Stack Master LED and Stack Number Display	86
PowerConnect 7000 Series Back Panel	87
Expansion Slots for Plug-in Modules	88
Power Supplies	89
Ventilation System	90
Locator LED	90
LED Definitions	91
Port LEDs	91
Module LEDs	93
System LEDs	95
Using Dell OpenManage Switch Administrator	97
About Dell OpenManage Switch Administrator	97
Starting the Application	98
Understanding the Interface	99
Defining Fields	101
Understanding the Device View	102
Using the Device View Port Features	102
Using the Device View Switch Locator Feature	102
Using the Command-Line Interface	103
Accessing the Switch Through the CLI	103
Console Connection	103
Telnet Connection	104
Understanding Command Modes	105
Entering CLI Commands	107
Using the Question Mark to Get Help	107
Using Command Completion	108
Entering Abbreviated Commands	108
Negating Commands	108
Understanding Error Messages	109
Recalling Commands from the History Buffer	109
Default Settings	111
Setting the IP Address and Other Basic Network Information	115
IP Address and Network Information Overview	115
What Is the Basic Network Information?	115
Why Is Basic Network Information Needed?	116
How Is Basic Network Information Configured?	117
What Is Out-of-Band Management and In-Band Management?	117
Default Network Information	119
Configuring Basic Network Information (Web)	120
Out-of-Band Interface	120
IP Interface Configuration (Default VLAN IP Address)	121
Route Entry Configuration (Switch Default Gateway)	122
Domain Name Server	124
Default Domain Name	125
Host Name Mapping	126
Dynamic Host Name Mapping	127
Configuring Basic Network Information (CLI)	128
Enabling the DHCP Client on the OOB Port	128
Enabling the DHCP Client on the Default VLAN	128
Managing DHCP Leases	129
Configuring Static Network Information on the OOB Port	130
Configuring Static Network Information on the Default VLAN	130
Configuring and Viewing Additional Network Information	131
Basic Network Information Configuration Example	132
Managing a Switch Stack	135
Stacking Overview	135
PowerConnect 7000 Series and M6348 Stacking Compatibility	137
How is the Management Unit Selected?	137
Adding a Switch to the Stack	138
Removing a Switch from the Stack	139
How is the Firmware Updated on the Stack?	140
What is Stacking Standby?	140
What is Nonstop Forwarding?	140
Switch Stack MAC Addressing and Stack Design Considerations	143
NSF Network Design Considerations	144
Why is Stacking Needed?	144
Default Stacking Values	145
Managing and Monitoring the Stack (Web)	146
Unit Configuration	146
Stack Summary	148
Stack Firmware Synchronization	149
Supported Switches	150
Stack Port Summary	151
Stack Port Counters	152
Stack Port Diagnostics	152
NSF Summary	153
Checkpoint Statistics	154
Managing the Stack (CLI)	155
Configuring Stack Member and NSF Settings	155
Viewing and Clearing Stacking and NSF Information	156
Stacking and NSF Usage Scenarios	157
Basic Failover	158
Preconfiguring a Stack Member	160
NSF in the Data Center	162
NSF and VoIP	163
NSF and DHCP Snooping	164
NSF and the Storage Access Network	165
NSF and Routed Access	167
Controlling Management Access	169
Management Access Control Overview	169
What Are the Recommendations for Management Security?	171
What Is an Authentication Profile?	171
How Does TACACS+ Control Management Access?	172
How Does RADIUS Control Management Access?	174
What are RADIUS Server Groups?	176
How Does the Switch Determine Which RADIUS Server to Contact?	176
What Other Features Use Authentication?	178
Default Management Security Values	178
Controlling Management Access (Web)	180
Access Profile	180
Authentication Profiles	184
Select Authentication	187
Password Management	188
Last Password Set Result	190
User Login Configuration	191
Local User Database	192
Line Password	194
Enable Password	194
TACACS+ Settings	195
RADIUS Global Configuration	197
RADIUS Server Configuration	198
RADIUS Accounting Server Configuration	200
RADIUS Accounting Server Statistics	202
RADIUS Server Statistics	203
Authorization Network RADIUS	204
Telnet Server	205
Denial of Service	206
Secure HTTP Configuration	207
Secure Shell Configuration	210
Secure Public Key Configuration	211
Controlling Management Access (CLI)	213
Configuring a Management Access List	213
Adding Users to the Local Database	215
Configuring and Applying Authentication Profiles	216
Managing Passwords	217
Configuring RADIUS Server Information	219
Configuring TACACS+ Server Information	221
Configuring Telnet and SSH Access	222
Configuring HTTP and HTTPS Access	223
Configuring DoS Information	225
Management Access Configuration Examples	227
Configuring a Management Access List	227
Configuring the Primary and Secondary RADIUS Servers	228
Configuring an Authentication Profile	230
Configuring Password Lockout	231
Monitoring and Logging System Information	235
System Monitoring Overview	235
What System Information Is Monitored?	235
Why Is System Information Needed?	236
Where Are Log Messages Sent?	236
What Are the Severity Levels?	237
What Are the System Startup and Operation Logs?	237
What Is the Log Message Format?	238
What Factors Should Be Considered When Configuring Logging?	239
Default Log Settings	239
Monitoring System Information and Configuring Logging (Web)	240
Device Information	240
System Health	242
System Resources	243
Unit Power Usage History	244
Integrated Cable Test for Copper Cables	245
Optical Transceiver Diagnostics	246
Log Global Settings	248
RAM Log	249
Log File	250
Remote Log Server	250
Email Alert Global Configuration	253
Email Alert Mail Server Configuration	254
Email Alert Subject Configuration	256
Email Alert To Address Configuration	257
Email Alert Statistics	258
Monitoring System Information and Configuring Logging (CLI)	259
Viewing System Information and Enabling the Locator LED	259
Running Cable Diagnostics	259
Configuring Local Logging	260
Configuring Remote Logging	262
Configuring Mail Server Settings	263
Configuring Email Alerts for Log Messages	264
Logging Configuration Examples	266
Configuring Local and Remote Logging	266
Configuring Email Alerting	268
Managing General System Settings	271
System Settings Overview	271
Why Does System Information Need to Be Configured?	272
What Are SDM Templates?	273
Why is the System Time Needed?	274
How Does SNTP Work?	274
What Configuration Is Required for Plug-In Modules?	275
What Are the Key PoE Plus Features for the PC7024P and PC7048P?	275
Default General System Information	277
Configuring General System Settings (Web)	278
System Information	278
CLI Banner	281
SDM Template Preference	282
Clock	283
SNTP Global Settings	284
SNTP Authentication	285
SNTP Server	287
Summer Time Configuration	291
Time Zone Configuration	292
Card Configuration	293
Slot Summary	294
Supported Cards	295
Power Over Ethernet Global Configuration (7024P/7048P Only)	296
Power Over Ethernet Interface Configuration (7024P/7048P Only)	297
Configuring System Settings (CLI)	299
Configuring System Information	299
Configuring the Banner	300
Managing the SDM Template	301
Configuring SNTP Authentication and an SNTP Server	301
Setting the System Time and Date Manually	303
Configuring the Expansion Slots	304
Configuring PoE Settings (7024P/7048P Only)	305
General System Settings Configuration Examples	308
Configuring System and Banner Information	308
Configuring SNTP	310
Configuring the Time Manually	312
Configuring SNMP	313
SNMP Overview	313
What Is SNMP?	313
What Are SNMP Traps?	314
Why Is SNMP Needed?	315
Default SNMP Values	315
Configuring SNMP (Web)	317
SNMP Global Parameters	317
SNMP View Settings	318
Access Control Group	320
SNMPv3 User Security Model (USM)	321
Communities	324
Notification Filter	327
Notification Recipients	328
Trap Flags	331
OSPFv2 Trap Flags	332
OSPFv3 Trap Flags	333
Trap Log	334
Configuring SNMP (CLI)	335
Configuring the SNMPv3 Engine ID	335
Configuring SNMP Views, Groups, and Users	336
Configuring Communities	339
Configuring SNMP Notifications (Traps and Informs)	341
SNMP Configuration Examples	344
Configuring SNMPv1 and SNMPv2	344
Configuring SNMPv3	345
Managing Images and Files	349
Image and File Management Overview	349
What Files Can Be Managed?	349
Why Is File Management Needed?	351
What Methods Are Supported for File Management?	353
What Factors Should Be Considered When Managing Files?	353
How Is the Running Configuration Saved?	355
Managing Images and Files (Web)	356
File System	356
Active Images	357
USB Flash Drive	358
File Download	359
File Upload	361
Copy Files	363
Managing Images and Files (CLI)	364
Downloading and Activating a New Image (TFTP)	364
Managing Files in Internal Flash	365
Managing Files on a USB Flash Device	366
Uploading a Configuration File (SCP)	366
Managing Configuration Scripts (SFTP)	367
File and Image Management Configuration Examples	368
Upgrading the Firmware	368
Managing Configuration Scripts	371
Managing Files by Using the USB Flash Drive	373
Automatically Updating the Image and Configuration	375
Auto Configuration Overview	375
What Is USB Auto Configuration?	376
What Files Does USB Auto Configuration Use?	376
How Does USB Auto Configuration Use the Files on the USB Device?	377
What Is the Setup File Format?	378
What Is the DHCP Auto Configuration Process?	379
Monitoring and Completing the DHCP Auto Configuration Process	383
What Are the Dependencies for DHCP Auto Configuration?	384
Default Auto Configuration Values	385
Managing Auto Configuration (Web)	386
Auto-Install Configuration	386
Managing Auto Configuration (CLI)	387
Managing Auto Configuration	387
Auto Configuration Example	388
Enabling USB Auto Configuration and Auto Image Download	388
Enabling DHCP Auto Configuration and Auto Image Download	390
Monitoring Switch Traffic	391
Traffic Monitoring Overview	391
What is sFlow Technology?	391
What is RMON?	394
What is Port Mirroring?	395
Why is Traffic Monitoring Needed?	396
Default Traffic Monitoring Values	396
Monitoring Switch Traffic (Web)	397
sFlow Agent Summary	397
sFlow Receiver Configuration	398
sFlow Sampler Configuration	399
sFlow Poll Configuration	400
Interface Statistics	401
Etherlike Statistics	402
GVRP Statistics	403
EAP Statistics	404
Utilization Summary	405
Counter Summary	406
Switchport Statistics	407
RMON Statistics	408
RMON History Control Statistics	409
RMON History Table	411
RMON Event Control	412
RMON Event Log	414
RMON Alarms	415
Port Statistics	417
LAG Statistics	418
Port Mirroring	419
Monitoring Switch Traffic (CLI)	421
Configuring sFlow	421
Configuring RMON	423
Viewing Statistics	425
Configuring Port Mirroring	426
Traffic Monitoring Configuration Examples	427
Configuring sFlow	427
Configuring RMON	429
Configuring iSCSI Optimization	431
iSCSI Optimization Overview	431
When Should iSCSI Optimization Be Enabled?	432
How Does the Switch Detect iSCSI Traffic Flows?	432
How Is Quality of Service Applied to iSCSI Traffic Flows?	432
What Information Does the Switch Track in iSCSI Traffic Flows?	433
How Does iSCSI Optimization Interact With Dell EqualLogic Arrays?	433
What Occurs When iSCSI is Enabled or Disabled?	434
Default iSCSI Optimization Values	435
Configuring iSCSI Optimization (Web)	436
iSCSI Global Configuration	436
iSCSI Targets Table	437
iSCSI Sessions Table	438
iSCSI Sessions Detailed	439
Configuring iSCSI Optimization (CLI)	440
iSCSI Optimization Configuration Examples	442
Configuring iSCSI Optimization Between Servers and a Disk Array	442
Configuring a Captive Portal	445
Captive Portal Overview	445
What Does a Captive Portal Do?	445
Is the Captive Portal Feature Dependent on Any Other Feature?	446
What Factors Should Be Considered When Designing and Configuring a Captive Portal?	447
How Does Captive Portal Work?	448
What Captive Portal Pages Can Be Customized?	449
Default Captive Portal Behavior and Settings	450
Configuring the Captive Portal (Web)	452
Captive Portal Global Configuration	452
Captive Portal Configuration	453
Local User	458
User Group	462
Interface Association	464
Captive Portal Global Status	465
Captive Portal Activation and Activity Status	466
Interface Activation Status	467
Interface Capability Status	468
Client Summary	469
Client Detail	470
Captive Portal Interface Client Status	471
Captive Portal Client Status	472
Configuring a Captive Portal (CLI)	473
Configuring Global Captive Portal Settings	473
Creating and Configuring a Captive Portal	474
Configuring Captive Portal Groups and Users	477
Managing Captive Portal Clients	478
Captive Portal Configuration Example	479
Configuration Overview	480
Detailed Configuration Procedures	481
Configuring Port Characteristics	483
Port Overview	483
What Physical Port Characteristics Can Be Configured?	483
What is Link Dependency?	484
What Interface Types are Supported?	486
What is Interface Configuration Mode?	486